When the entity declaration is parsed, character entities are expanded
but general entities (including &) are not. (The table in section
4.4 is first place you should look in questions of this kind.)
So (as described in appendix D) the entity's value is
... (&) ... (&) ... (&) ...
When this is expanded in the instance, both character and general
entities are expanded (again, as specified in the table), producing
... (&) ... (&38;) ... (&) ...
in the text passed to the application.
-- Richard